CVE-2024-58294
FreePBX 16 Authenticated Remote Code Execution via API Module
- State
- Published
- Severity
- 8.7 High
- Published
- Dec 11, 2025
- Updated
- Jul 14, 2026
- Reserved
- Dec 11, 2025
Description
FreePBX 16 contains an authenticated remote code execution vulnerability in the API module that allows attackers with valid session credentials to execute arbitrary commands. Attackers can exploit the 'generatedocs' endpoint by crafting malicious POST requests with bash command injection to establish remote shell access.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.7 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
Weaknesses
- CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected Products
| Product | Versions |
|---|---|
FreePBXFreePBX |
|
References
- ExploitDB-52031exploit
- Official Product Homepageproduct
- Original Video Linkproduct
- VulnCheck Advisory: FreePBX 16 Authenticated Remote Code Execution via API Modulethird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.